Privacy Policy

1. What we collect

On this website

• Demo sign-ups: to watch a demo video, the name, work email, school or district, role, state, number of campuses and (if you give it) phone number you enter, and which demos you watch. They’re kept in our own sales system so we can follow up, and in your browser so you don’t have to fill them in again.
• Tour requests, funding plan requests and launch sign-ups: the name, work email, school or district, state, role, number of campuses, phone number and message you send us. A funding plan request on our funding guide also says which apps and funding programs you’re interested in and whether your district is rural, so we can send the plan and follow up.
• Emails you send us.
• Basic technical data: like any website, our hosting provider records standard information such as IP address, browser type and pages visited, to keep the site running and secure.

In the Weaverbird Subs service

• Account information: names, work emails, roles, campus, and sign-in details for admins, teachers, staff and substitutes.
• Sign-in and security records: each sign-in attempt and password reset request (the email typed, the time, the result, the browser, the network address, and a random device identifier kept in a cookie), used to block password guessing, to email you about sign-ins from a new device, and as a sign-in log your district’s administrators can see. If you turn on two-step sign-in, we keep your authenticator key encrypted and your backup codes only in scrambled (hashed) form.
• Activity log: each change someone signed in makes to your district’s settings, people and records (who, when, what kind of record, and which fields), shown to your district’s administrators beside the sign-in log, kept for three years. Secret values such as passwords are never recorded.
• One sign-in for the Weaverbird Works apps: if your district uses more than one of our apps, you can sign in once at app.weaverbirdworks.com. It checks your email and password with each app (between our own servers; your password isn’t stored there), and keeps a short record of each sign-in (your email, the time, the network address and which apps you opened). It also shows your to-dos from each app, fetched from them when you open the page and not stored there.
• Agreements: when you accept our Terms, choose texts or calls, or sign an agreement in Weaverbird Subs, we record your name, email, role, district, what you agreed to, its version and when, and when it was replaced or ended. These records are copied each night to Weaverbird HQ, our own internal system, where only our staff who handle legal matters can see them, so we can show what was agreed and when. We keep them while we provide the Service to your district and for as long afterwards as we may need to show an agreement was made. Your district’s administrators can see who in the district has agreed to what.
• Contested agreements: if an administrator contests someone’s agreement, we receive the person’s name, email and role, the agreement, the administrator’s reason, and a summary of what’s been done under it (such as how many texts or calls were sent, sign-ins and changes made), and keep them with our decision and the administrator’s signed agreement to it.
• To-dos and reminders: what’s waiting on you, tasks you or an administrator add (an administrator can give one to anyone in the district), when each is due and whether it repeats, and your choices of which to show and when to be reminded. If you turn it on, your to-dos with a due date are shown on your calendars and in your private calendar link.
• Quiet hours and missed notifications: the quiet hours you choose, and each email, text or call that arrived during them (its subject and text), kept for you to read in the app for 90 days and then deleted. If you turn on the summary, we also email you a list of their subjects once your quiet hours end.
• System checklists: which items of the quarterly and yearly review your district’s administrators have ticked, by whom and when; we see each district’s progress, not the people.
• Google and Microsoft sign-in: if you choose to sign in with Google or Microsoft, they tell us your name and the email address on that account, and whether it’s verified. We use it only to find your Weaverbird Subs account; we don’t receive your password, contacts, files or mail.
• Roster sync: if your district connects its student information system (through OneRoster) or a roster spreadsheet, we read its schools and its teachers’ and staff members’ names, emails, roles, grades and phone numbers to keep its Weaverbird Subs roster up to date. We don’t request student records. The connection’s secret is stored encrypted.
• Calendar feeds: if you subscribe to your Weaverbird Subs calendar, the calendar app you use (such as Google Calendar, Outlook or Apple Calendar) fetches your jobs or absences from a private link, and we note when it last did.
• Substitute information: phone number, subjects and grades, the qualifications your district records for you (such as a certificate, a language or a training) and when each ends, if your district turns that on, availability, text and call preferences, timesheets, check-in times, ratings and notes, and, if your district turns on sub training, the lessons you’ve opened in its online courses, your quiz scores and certificate numbers.
• Feedback from substitutes, if your district turns it on: after a day they worked, a substitute can rate the job from 1 to 5 and leave a note for the office. Administrators see it; the teacher doesn’t.
• Front office check-in kiosk, if your district turns it on: a tablet at each campus’s front desk shows the first names and last initials of that day’s substitutes there, and a substitute checks in or out by typing the last 4 digits of the phone on their account. We record the time and that it was at the kiosk, and count wrong tries to lock the job for 15 minutes after five.
• Staffing records: absences, leave types and balances, sub jobs, approvals, calendars, lesson plan files and pay rates entered by your school.
• Sick bank records, if your district uses the sick bank: who joined each school year and the days they gave, requests to draw days with the reason given, any doctor’s statement uploaded with a request, and each decision and note. A doctor’s statement may contain health information.
• Applicant information: what job applicants submit to a school, such as contact details, experience and documents.
• Support requests from administrators: their note, optional screenshots (which they can mark with circles and highlights) and an optional screen recording (with their voice if they turn on the microphone), the page they were on and their browser. Before their first request, administrators agree not to include anything about a student, health or medical details, government ID or financial account numbers, or passwords, and to close anything private before taking a screenshot or recording. If something sensitive is sent by mistake, tell us and we’ll delete it.
• Download records: when an administrator agrees to the Data Export Agreement (their name, the time and network address) and each report or payroll file they download (who, when, and the dates and campuses it covered), shown to their district’s administrators.
• Billing information: handled by Stripe; we see the plan, status and last four digits of a card, not the full number.

2. How we use it

• To run Weaverbird Subs: posting jobs, matching and notifying subs, sharing lesson plans with the covering sub (plans attached to a request can also be seen by the subs who can take that job, before they pick it up), timesheets and payroll exports, leave balances, and the sick bank.
• To send the emails, texts and calls the Service needs, such as job alerts, invites and password resets.
• To provide support, keep the Service secure, and fix and improve it.
• To answer support requests: an AI assistant takes a first look at each request’s note and screenshots to help our support team sort it and draft an answer. A person at Weaverbird Subs reads and sends every reply.
• To answer tour requests, funding plan requests and questions you send us, and to follow up with people who watched a demo.
• To meet legal obligations.

We do not sell personal information, share it for cross-context behavioral advertising, or use it to build advertising profiles.

3. Schools and student privacy

In the Service, we act for the school or district that uses Weaverbird Subs. The school decides what goes in and who can see it, and each district’s data is kept separate. Weaverbird Subs is built for staffing records, not student records. If education records covered by the Family Educational Rights and Privacy Act (FERPA) or a state student privacy law are put into Weaverbird Subs, for example in a lesson plan, we handle them as a “school official” under the school’s direct control, use them only to provide the Service, and never use them for advertising. Questions about your records? Contact your school first; we’ll help it respond.

4. Sick bank and health information

Doctor’s statements and the reasons given in sick bank requests are used only so the district can review and decide the request. Inside Weaverbird Subs, only the staff member who sent them and approved administrators can see them. No administrator has access by default: an administrator must sign our Sick Bank Medical Information Confidentiality Agreement, and we confirm with their district that they review sick bank requests before turning access on. The district can remove an administrator’s access at any time. Other administrators, substitutes, other staff and Weaverbird Subs’ own team cannot open doctor’s statements. To confirm, we email the district’s main contact (usually whoever signed the district up) a private link, and they answer yes or no and sign with their name. We keep a record of each signed agreement and each confirmation (name, date and time, and network address), and each decision. We never use this information for advertising, sell it, or share it beyond the service providers described below that store and deliver it for us.

We hold this information for the school or district, which decides how it is used and how long it is kept; it is the district’s employment record, not a health care record. Statements are deleted automatically when the district’s retention period ends (three years after the request is decided, unless the district chooses otherwise; see Security and retention). Staff should upload only what their district asks for, not full medical records. Questions about a request or a statement should go to your district first.

5. Who we share it with

We share information only with service providers that help us run Weaverbird Subs, under contracts that limit their use of it to providing their service to us:

• Hosting and security: running this website, the app and its database, keeping an encrypted off-site copy of our backups, and the bot check on the sign-in page. New passwords are checked against known data breaches without the password itself ever being sent.
• Payments: processing subscription payments.
• Messaging: delivering the emails, texts and automated calls the Service sends, and turning what an automated call says (which can include a name, a school and a job) into natural-sounding speech.
• Address suggestions: when someone types an address into Weaverbird Subs (a campus, a vendor, a home address, or an address question on a form), what they’ve typed so far is sent from our servers to an address search built on OpenStreetMap (Photon, run by komoot) to suggest matching US addresses. Only the typed words are sent: not who typed them, their district, or anything else, so the search service never learns who it was. Typing the whole address and ignoring the suggestions works just the same.
• Support: an AI assistant that takes a first look at support requests (the note and screenshots an administrator sends, not recordings; it doesn’t use them to train its models), and tools for tracking and fixing reported bugs, which never receive the district, names, contact details, screenshots or recordings.
• Website forms and scheduling: delivering tour requests and launch sign-ups, and booking live demos on our calendar.

For a current list of our service providers and what each one does, email privacy@weaverbirdworks.com. Districts with a data privacy agreement get this list, and notice when it changes.

Between your district’s own apps. If your district uses other Weaverbird Works apps and connects them to Weaverbird Subs, information it chooses to share moves between them: for example absence and leave requests (who, the dates, the kind of leave, the reason typed, decisions and notes) between Weaverbird Subs and Weaverbird HR, matched by sign-in email, or what someone fills in on a form in Weaverbird Builder (their name, email, answers and an approver’s note) sent here as a request, with how it’s going sent back. Only the forms and requests the district sets up are shared, only within the district, and it stays the district’s information. Connected apps also keep the district’s setup once: its campuses (names, addresses and phone numbers), its grade, department and subject lists, and its teachers and staff (names, emails, campuses, roles, departments, grades and phone numbers) are kept in one of its apps (Weaverbird HR first, if the district uses it) and copied to the others it connects, and someone turned off there is turned off in the others. Passwords, sign-in settings, consents and notification choices are never copied. When Weaverbird HR starts someone’s onboarding or offboarding, the steps for IT, facilities and the business office (with the person’s name, email, role, campus and start or last day) go to the district’s Weaverbird Help Desk, Weaverbird Facilities and Weaverbird Finance, which add the devices, keys or purchasing cards they have there so they can be collected, and say back when the work is done. The district’s vendors (business names and contact details) are kept in Weaverbird Finance when it’s connected and copied to the others, and a work order can ask it for a purchase order. If the district connects Weaverbird HR and Weaverbird Finance and an Weaverbird HR admin turns on position budgeting (it’s off until they do, and they agree to share this first), Weaverbird Finance reads the district’s positions from Weaverbird HR to budget them (each position’s title, campus, department and FTE, the name of the person in it and their yearly salary from the district’s salary schedule), and tells Weaverbird HR which positions its adopted budget funds. Turning it off stops this straight away.

Inside a school’s Weaverbird Subs, information is shared with the people who need it, for example a sub’s name with the teacher they’re covering for. We may also share information if the law requires it, to protect people’s safety, or as part of a merger or sale of our business, in which case this policy continues to apply.

6. Texts and calls

We text or call someone only after they agree to it themselves in Weaverbird Subs, separately for texts and for calls; no one can agree for them. During their quiet hours, texts and calls aren’t sent (except security messages, and urgent alerts they allow), and while an administrator’s contest of their agreement is open, none are sent at all. A substitute can also turn on notifications for the Weaverbird Subs app on a phone; we then keep that phone’s notification address, which its browser’s push service (such as Google’s or Apple’s) gives us, and send job alerts through that service, encrypted so it can’t read them. Turning it off on the phone deletes the address. Teachers, staff and substitutes can also call or text their district’s Weaverbird Subs number to report an absence or pick up a job: we read what they send, and match it to their account by the phone number on it, only to carry out the request and reply; a call also needs the PIN they set, which we keep only in scrambled (hashed) form. Our replies are texts like any other. Phone numbers and consent are never shared with third parties for their marketing. Reply STOP to any text to opt out. See our Text and call terms.

7. Cookies

This website doesn’t use advertising or tracking cookies. We count visits with Cloudflare Web Analytics, which doesn’t use cookies or track you across sites. The Weaverbird Subs app uses a cookie to keep you signed in, and one that remembers your device so we can tell you about sign-ins from new ones. Our hosting provider may set cookies needed for security.

8. Security and retention

We use encryption in transit, hashed passwords, access controls that keep each district’s data separate, and the ability to sign a person out everywhere. We keep a school’s data while its subscription is active. After it ends, the school can ask us for a copy of its data for 30 days, and we then delete it within 60 days, except copies the law requires us to keep or that sit in backups until they expire. Some files are deleted sooner, automatically. Each district chooses how long its school records are kept, in Settings: its state’s record retention minimums (as we have them from published schedules and federal rules), or its own periods. The district is responsible for confirming its choice meets its requirements. Until a district chooses, these standard periods apply:

• Lesson plans for a specific date or request: one year after that date, or after the request’s last day. Plans without a date, such as emergency sub plans, are kept until they’re removed.
• Doctor’s statements on sick bank requests: three years after the request is decided.
• Applicants’ documents: two years after the application is turned down or withdrawn. Documents of people who were hired stay with the district.

Screen recordings and screenshots sent with a support request are deleted 90 days after the request is resolved (the request itself is kept). Missed notifications are deleted 90 days after they arrive.

We take a backup of our database each night and keep each one for 14 days. So we can recover even if our main host has a problem, an encrypted copy of each nightly backup, and of the files uploaded to Weaverbird Subs, is also kept with a second storage provider. The copies are encrypted before they leave our servers and only we hold the key; backups are kept there for the same 14 days, and an uploaded file’s copy is removed when the file is removed from Weaverbird Subs. We keep tour requests for as long as needed to follow up, and delete them on request.

9. Your choices and rights

• Everyone can turn texts and calls on or off, choose which notifications they get, and set quiet hours, in their own settings at any time.
• You can ask to see, correct or delete your information. If your information is in a school’s Weaverbird Subs, we’ll pass your request to that school, which controls it.
• Depending on where you live (for example California and other US states), you may have additional rights. We will honor them and won’t treat you differently for using them.

To make a request, email privacy@weaverbirdworks.com.

10. Children

Weaverbird Subs is for school staff, substitutes and job applicants, not for children. We don’t knowingly collect personal information from children under 13. If you believe a child has given us information, email us and we will delete it.

11. Changes and contact

We may update this policy and will change the date above when we do. If a change is significant, we’ll tell account owners before it takes effect. Questions or requests: privacy@weaverbirdworks.com.